A multi-dimensional code quality gate and security audit skill that validates correctness, architecture, performance, and AI agent integrity before merge or deployment.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install mimo-code-review-and-quality
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install mimo-code-review-and-quality using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Code Review and Quality Agent Skill?
The Code Review and Quality skill is an industry-grade gatekeeper designed to enforce exceptional engineering standards across five critical dimensions: correctness, readability, architecture, security, and performance. Beyond standard static analysis, this tool integrates cutting-edge AI security frameworks. It implements the NVIDIA SkillSpector 16-class vulnerability detection, Palo Alto Unit 42’s Behavior Integrity Validation (BIV), and robust Model Context Protocol (MCP) server security audits.
As part of the Openclaw Skills ecosystem, it addresses the unique security risks of modern AI-driven environments, where unchecked agent capabilities can lead to prompt injection, data exfiltration, or malicious dependency executions. By integrating this skill, development teams can automate rigorous code quality gates, detect composite threat chains, and ensure that every pull request, agent skill configuration, and MCP server deployment remains safe, performant, and compliant with best-practice architecture.
Code Review and Quality Agent Skill Use Cases
- Evaluating pull requests and code changes prior to merging them into production.
- Auditing third-party AI agent tools and configurations before installation to prevent supply chain attacks.
- Securing Model Context Protocol (MCP) server deployments by validating OAuth settings, loopback bindings, and permission profiles.
- Enforcing code quality, readability, and performance standards during refactoring cycles or bug fixes.
- Assessing structural technical proposals and design documents before development begins.
How Code Review and Quality Agent Skill Works
- Context Alignment: Understands the intent, task requirements, and expected behavior change before inspecting code.
- Test-First Evaluation: Examines unit, integration, and regression tests to verify that edge cases, error pathways, and target behaviors are properly covered.
- Five-Axis Code Analysis: Audits the implementation across correctness, readability, architecture, security, and performance.
- Behavioral Integrity Validation (BIV): Cross-references metadata, executable code, and natural language statements in the skill manifest to catch hidden behavioral deviations.
- MCP Server Security Evaluation: Performs runtime and configuration checks (e.g., verifying access tokens, loopback bindings, credential sanitization, and output limits).
- Categorized Findings Generation: Generates a structured feedback report with ranked severity tags (Critical, Important, Nit, Optional, FYI) and a clear merge verdict (Approve or Request Changes).
Code Review and Quality Agent Skill Setup
To implement this quality and security gate in your workflow:
- Install and Configure: Ensure the code review configuration files are initialized in your repository's .github/ or custom review directory.
- Run Dependency Checks: Ensure dependencies are locked and validated. Run a quick static scan on scripts using standard utility tools:
# Audit dangerous function executions in the code
grep -rn 'exec\\|eval\\|subprocess\\|__import__' scripts/
# Detect external network dependencies
grep -rn 'fetch\\|http\\|https\\|curl\\|wget' scripts/
- Execute Behavioral Integrity Validation (BIV): Evaluate the alignment between the skill’s manifest, description, and actual code footprint:
grep -i 'description\\|capabilities' SKILL.md
grep -rn 'writeFile\\|deleteFile\\|exec' scripts/
- Perform MCP Security Audit: For deployments hosting model-driven APIs, run verification scripts to evaluate runtime safety profiles.
This workflow integrates directly with standard continuous integration pipelines or as a command-line utility in Openclaw Skills setups.
Code Review and Quality Agent Skill Data Schema & Taxonomy
The Code Review and Quality skill operates on a clear validation taxonomy to classify and resolve code or agent flaws.
Severity Level Schema
| Severity | Definition | Action Required |
|---|---|---|
| Critical | Blockers: Security holes, data loss risks, or broken core features. | Must resolve immediately before merging. |
| Important | Structural issues or significant regressions. | Resolution required before merge. |
| Nit | Minor improvements, stylistic guidelines, formatting preferences. | Optional; up to developer discretion. |
| Optional | Constructive architectural recommendations. | Worth consideration for future refactors. |
| FYI | Reference information, contextual notes. | No action required. |
Integrity & Deviation Grading
- Benign: Standard documentation omissions with no risk.
- Suspicious: Manifest mismatch (e.g., declared offline but executing API calls) requiring explanation.
- Malicious: Active credential harvesting, network exfiltration, or rogue persistent agent hooks. Trigger immediate rejection.
MCP Server Safety Ratings
- Rating A: Default read-only access, credential sanitization, transaction confirmation, and robust output bounds. Ready for production.
- Rating B: Standard protections in place, minor non-critical configurations omitted. Ready after minor adjustments.
- Rating C: Missing crucial restrictions (e.g., default write access, no output caps). Requires remediation.
- Rating F: Missing basic authentication and boundary limitations. Rejected.
Code Review and Quality Agent Skill Advanced Features
- Composite Threat Chain Detection: Evaluates multi-step exploits (e.g., READ -> ENCODE -> SEND) where individual steps appear benign but together form an exfiltration payload.
- NVIDIA SkillSpector Ruleset Implementation: Automates checks for prompt injection, privilege escalation, memory poisoning, system prompt leaks, and over-agency.
- Model Context Protocol (MCP) Audit Engine: Validates modern enterprise agent connectivity profiles including OAuth 2.1 PKCE requirements and loopback network protections.
- BIV Triple-Check Logic: Runs cross-analysis checking Natural Language Declarations vs. Executable Actions vs. Metadata Privileges to catch hidden, unauthorized code behaviors.
- Context-Preserving Feedback Loops: Empowers development systems with structured markdown templates, prioritizing technical data and styles guides over subjective opinions.
SKILL.md
Loading
Related Openclaw Skills
diagnose
A disciplined, multi-phase diagnosis loop designed for tracing hard bugs and performance regressions through structured reproduction and feedback loops.
Prototype Skill
A dedicated AI agent skill for building quick, throwaway prototypes to validate architectural logic or UI designs before committing to production code.
TDD
A systematic, test-driven development workflow designed to guide AI agents through precise, vertical red-green-refactor loops.
Grill-Me
An aggressive, investigative AI-driven interviewing framework designed to stress-test your system architectures, technical designs, and plans until true alignment is achieved.
AI Video Factory
An automated short-video generation skill that transforms a single topic prompt into a complete, high-quality video ready for multi-platform distribution.
Caveman Mode
Caveman Mode is an ultra-compressed communication protocol that cuts LLM token consumption by up to 75% by discarding conversational filler and articles while retaining 100% technical accuracy.
Featured*
